Seems like it makes the problem worse because you are then tied to a specific version at time of publishing and need to republish to get any framework patches.
Indeed. Microsoft identified this as a problem as well and pushes .NET security patches via Windows Update nowadays. When using self-contained apps, you won't get these patches.
.NET Core security patches aren't pushed via Windows Update, only .NET Framework (since it's built into Windows). Unless something changed recently?
News to me! I always deploy .NET 5/6 stuff on Linux, explains why I'm out of the loop. Thanks!
You missed how there effectively isn't a .NET Core/.NET Framework delination anymore. It is just .NET, and .NET gets security patches from Windows Update.
.NET Core got renamed into .NET as of .NET 5, and it is still quite relevant to make a difference, plenty of people still don't get it.